Information
When you install the Universal Control Plane without providing your own TLS certificates, it will, by default, configure self-signed certificates. You should instead use certificates signed by an external, trusted certified authority as these mitigate the overhead of having to distribute certificate authority certificates to all of the nodes in a Universal Control Plane cluster and additionally are in line with good security practice.
Rationale:
By default, UCP is configured to use untrusted, self-signed certificates. Using UCP with externally trusted certificate authorities is a more streamlined and secure option.
Solution
You can configure your own certificates for UCP either during installation or after installation via the UCP 'Admin Settings' user interface.
Customize certificates during installation:
Create a volume named ucp-controller-server-certs on your primary UCP Manager installation node:
docker volume create ucp-controller-server-certs
Copy your external certificate authority's public certificate file (ca.pem) and your signed certificate (cert.pem) and key (key.pem) files to the root directory of the volume
cp ca.pem cert.pem key.pem $(docker volume inspect --format '{{ .Mountpoint }}' ucp-controller-server-certs)/
Run the UCP installation command with the --external-server-cert flag
Customize certificates post-installation via the 'Admin Settings' UI:
Refer to the instructions at https://docs.docker.com/datacenter/ucp/2.2/guides/admin/configure/use-your-own-tls-certificates/#configure-ucp-to-use-your-own-tls-certificates-and-keys for configuring your own certificates via the UCP UI.
Impact:
None.
Default Value:
Self-signed certificates are configured by default.